fkrebs
895658a115
- zoraxy.md: fix arcane upstream to CT109 (192.168.1.8:10002), add SkipWebSocketOriginCheck column, note missing routes (dozzle, etc.) - arcane.md: reflect CT109 migration complete, expand agent table to all 8 environments, fix MANAGER_API_URL and DB paths - ct-inventory.md: CT103 RAM 512→4096+swap; CT109 footnote complete - proxmox-memory-audit.md: CT103 bump, add CT109+CT113 rows, fix sum - portmap.md: add Wetty row, fix arcane backend, WAL-G scrape target, homepage decommissioned, dozzle LAN-only note - mcp-gateway.md: add gitea/paperless/proxmox, count 26→29 servers - RESUME.md: check off WAL-G, Loki, Zoraxy audit; CT109 in key state table; session ×4 completed items block Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
4.5 KiB
CT / VM inventory
Verified 2026-05-20 via pct list, pct config <id>, qm config 100 on nuc.
| VMID | Name | Type | IP | Cores | RAM (MiB) | Rootfs | Role | UNAS mount | GPU | Status |
|---|---|---|---|---|---|---|---|---|---|---|
| 100 | haos | VM (q35/OVMF) | DHCP via vmbr0 (.60) |
4 | 16384 (balloon 4096) | 32 GiB local-zfs | Home Assistant OS; USB Zigbee dongle (10c4:ea60) passed through → Zigbee2MQTT add-on + Mosquitto broker add-on; OCPP (EV charger); ~2492 entities | — | no | running |
| 101 | shepard | LXC unpriv | 192.168.1.49/24 | 12 | 32768 | 500 GiB | Shepard product stack (Caddy, frontend, backend, Keycloak, Mongo, Neo4j, TimescaleDB) | mp0 NFS | Intel iGPU (card+render) | running |
| 102 | dns | LXC unpriv | 192.168.1.2/24 | 2 | 1024 | 4 GiB | AdGuard Home — LAN DNS resolver + filter | — | no | running |
| 103 | backrest | LXC unpriv | 192.168.1.3/24 | 1 | 4096 + 1024 swap | 8 GiB | Backrest (restic) backup scheduler | mp0 NFS | no | running |
| 104 | docker | LXC unpriv (idmapped) | 192.168.1.40/24 | 16 | 49152 | 200 GiB | Main Docker host — AI/ML + media + identity-adjacent (~65 containers) | mp0 NFS | Intel iGPU (card+render) | running |
| 105 | nextcloud | LXC priv | 192.168.1.41/24 | 4 | 8196 | 100 GiB | Nextcloud AIO | mp0 NFS | Intel iGPU (render only) | running |
| 108 | zoraxy | LXC unpriv | 192.168.1.4/24 | 2 | 2048 | 6 GiB | Zoraxy reverse proxy + ACME (*.nuclide.systems) |
— | no | running |
| 109 | ops | LXC unpriv | 192.168.1.8/24 | 4 | 4096 | 32 GiB | Ops — Prometheus + Grafana + Loki + Alloy + pve-exporter + Homarr + Arcane (server) + Dozzle (server) + docs-server; headless Arcane+Dozzle agents on all 7 Docker hosts | — | no | running |
| 110 | id | LXC unpriv | 192.168.1.5/24 | 1 | 1024 | 4 GiB | Pocket-ID OIDC IdP (id.nuclide.systems); migrated off CT 104 on 2026-05-20 |
— | no | running |
| 111 | dev | LXC unpriv | 192.168.1.42/24 | 12 | 32768 | 60 GiB | Dev host — Coder + Gitea + workspaces | mp0 NFS | Intel iGPU (render only; symlinked at /dev/dri/renderD128) |
running |
| 112 | secrets | LXC unpriv | 192.168.1.7/24 | 2 | 4096 | 20 GiB | Infisical secrets manager (own Postgres 16 + Redis 7; replaces scattered .env files) — LAN-only, no Zoraxy route | — | no | running |
| 113 | db | LXC unpriv | 192.168.1.6/24 | 2 | 4096 | 40 GiB | Shared Postgres 17 + pgAdmin + WAL-G → Garage S3; Arcane edge agent | — | no | running |
UNAS NFS = 192.168.1.31:/var/nfs/shared/storage over NFSv3. CT 105 (Nextcloud) is the lone outlier — it mounts the same UNAS share over CIFS/SMB 3.1.1, not NFS.
CT 112 ("secrets") — Infisical deployed 2026-05-22; see services/secrets-manager.md. LAN: http://192.168.1.7:8200. No Zoraxy route — secrets must not be internet-exposed.
CT 105 ("nextcloud") — migrated from CIFS (//192.168.1.31/storage) to NFS (192.168.1.31:/var/nfs/shared/storage) on 2026-05-22. CIFS mount was not remounting after host reboots, causing Nextcloud crash-loops. NFS is consistent with all other CTs.
SSH access
The Proxmox host (nuc, 192.168.1.20) has root SSH access to all LXC containers via key auth. To grant your own key access to every running container in one step, run on the host:
deploy-ssh-key "ssh-ed25519 AAAA... you@yourmachine"
# or pipe it:
ssh nuc 'cat' < ~/.ssh/id_ed25519.pub | deploy-ssh-key
Script is at /usr/local/bin/deploy-ssh-key. It iterates pct list, skips stopped CTs, and appends the key to /root/.ssh/authorized_keys idempotently (no duplicates).
VM 100 (HAOS, 192.168.1.60) cannot be reached via pct exec. Install manually in the HA terminal:
echo "ssh-ed25519 AAAA... you@yourmachine" >> ~/.ssh/authorized_keys
Host key (root@nuc, already deployed to all CTs 2026-05-21):
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCuVqBW3VXg... root@nuc
CT 113 ("db") provisioned 2026-05-21; see services/databases.md. Future role: consolidate per-stack Postgres instances once second NVMe lands.
CT 109 ("ops") provisioned 2026-05-23. Debian 13, Docker 29.5.2. Stack /opt/stacks/monitoring: Prometheus (:9090), Grafana (:3000 — LAN only, admin/tapirnase), Loki (:3100), node-exporter (:9100 host-net), pve-exporter (:9221), Alloy (:12345), Homarr (:7575), Arcane server (:10002), Dozzle server (:10001), docs-server (:13080), Wetty web-SSH (:4090 LAN-only). Scrapes: litellm CT 104 :14000/metrics/, node-ct104 :9100, node-ct109 :9100, walg CT 113 :9100/textfile. CT 104 runs a standalone node-exporter (/opt/stacks/monitoring/) for CT 109 to scrape.